Cisco Talos has identified UAT-8302, a China-linked espionage group actively targeting government networks across South America and southeastern Europe. The group abuses Microsoft cloud services, OneDrive and the MS Graph API, as command-and-control channels, making malicious traffic difficult to distinguish from normal enterprise activity. Post-compromise activity focuses on Active Directory and hybrid identity infrastructure, creating risk of credential theft, persistent access, and potential spillover to cloud-connected environments.